By Phantom PenTest · Published
1. Start with the access objective
Identify the areas and assets the program is intended to protect. Explain who needs access, when it is needed and who can approve it. The relevant question is whether access matches an operational need and an agreed security requirement.
A public reception area, a staff-only corridor and a critical equipment room have different purposes. The assessment should examine those distinctions instead of treating every controlled door as having the same requirements.
2. Review approval and permission management
Trace a sample of approved access decisions through the administrative process within the agreed scope. Check whether the responsible person is identifiable and whether access groups, schedules and exceptions reflect current roles.
- Who can approve access, and how is that approval recorded?
- Are permissions based on current job responsibilities?
- Who reviews temporary, unusual or elevated access?
- How are access changes communicated when someone moves roles?
- Who checks that inactive or unnecessary permissions are removed?
The objective is to understand how access is governed. Avoid collecting more personal information than the review requires, and agree how any access records will be handled.
3. Evaluate credentials and physical entry points
Review how credentials are issued, replaced, reported lost and withdrawn. Consider how staff identify a credential holder and manage exceptions. Administrative controls need to match what happens at the entrance.
At agreed entry points, consider door condition, closing and latching, reader placement, physical barriers and relevant operating procedures. A system can record a decision while the physical opening fails to support the intended restriction. Any functional checks should be planned with the responsible stakeholders.
Access restrictions must also account for safe movement and emergency arrangements. Identify concerns for the appropriate responsible parties; this checklist does not replace a specialist life-safety review or approval.
4. Follow the visitor and contractor journey
Consider arrival, host verification, temporary credentials, permitted areas, escort arrangements and departure. Include the normal working conditions that affect the process, such as deliveries, busy reception periods and work outside regular hours.
- Who confirms the visitor or contractor has a valid purpose?
- How are access limits and escort responsibilities communicated?
- What happens if the host is unavailable?
- How are temporary permissions ended and credentials recovered?
- How are exceptions documented and escalated?
These are review questions, not instructions to attempt entry. Any controlled scenario intended to validate the workflow needs separate authorization and agreed boundaries.
5. Examine monitoring and response
Where included, establish what happens after an access exception or relevant alarm. Identify who receives the information, how they interpret it, what action is expected and how the outcome is recorded. A notification without a clear owner may provide limited operational value.
Look at handoffs between access administrators, facilities, security personnel and monitoring teams. If cameras or alarm systems form part of the response, a Security Systems Assessment may provide the appropriate additional focus.
6. Check the full access lifecycle
A review should extend beyond onboarding. Role changes, contract end dates, lost credentials and departures all create access decisions. Examine whether the expected notification reaches the person responsible for changing permissions and whether completion is confirmed.
Periodic reviews can help identify permissions that no longer have an owner or a business purpose. The assessment should establish how your organization performs those reviews and where responsibility is unclear, rather than assume a universal review interval fits every site.
What should the findings tell leadership?
A useful finding identifies the observed condition, supporting evidence, affected control, potential consequence and practical recommendation. Explain which areas were reviewed and any limits on sampling or access. Priorities should reflect exposure and consequences, not simply the number of observations.
Phantom PenTest's Access Control Assessment connects permissions, physical safeguards and operating practice. Where policy ownership or training is the wider concern, a Security Program Assessment can examine that context.
Common access control questions
Is an access control assessment just a badge-system check?
No. Technology is one part of the program. Approval, physical doors, visitors, staff decisions, monitoring and access removal can all affect whether the control achieves its purpose.
Will you attempt to bypass our doors?
A routine assessment does not itself authorize attempted entry. Controlled physical testing requires an expressly agreed scope, written authorization and defined operational boundaries.
How should we prepare?
Identify your main questions, a site coordinator and the available procedures or inventories. Use the preparation guide to plan document handling, access arrangements and stakeholders.